I use 1Password on all my machines to synchronize appropriate credentials between them. I have many VMs and utilities like the ssh-agent make managing ssh credentials easier and safer than leaving unencrypted private keys laying around the filesystem. I've used 1Password since it came out, and now use it at work. 1Password has first-class Linux support and has for a while. However, recently I've tried to use Linux as little as possible for boring and predictable reasons. Since I was a teenager, FreeBSD and OpenBSD have felt like more complete systems and share a kind of (tortured) kinship with MacOS, which I use most of the time.
The 1Password Firefox extension has most of 1Password's functionality and works perfectly on every OS I've tested it on. But it doesn't work offline.
FreeBSD has Linux binary compatibility, so how hard could it be? I wanted to understand how this system works, so I did much of this manually. But! If you want to get Linux apps up and running quickly and are okay with Ubuntu, this guide and its accompanying scripts will be more useful than these exploratory notes. I took many of the scripts and resource files from that guide.
Regardless of what you do, don't use the FreeBSD Handbook recommendation of installing the package for CentOS 7 as the base Linuxulator system. That is woefully outdated for modern systems requiring contemporary dependencies.
This is more or less a reconstruction of what I did from notes, the current config files on the system I am writing this on, and shell history files. It is bound to be inaccurate and imprecise. Beware, and do not dive into this without comfort in the shell. When I first tried this I somehow messed up my user's
uid and had to reset it and the permissions on all my files, both in the
chroot and in my user's
$HOME directory. Beware.
I wanted 1Password running in KDE Plasma with a functional clipboard, communication with the 1Password Firefox extension, saved 2FA keys for persistent sessions between wallet unlocks, and interaction with hardware Yubikeys.
What I got was just the first part: 1Password 8 running in KDE Plasma with access to the clipboard. The rest of it I haven't figured out, but then again I think I'm moving more towards OpenBSD for my non-Apple machines (and some of the Apple ones) so my next step is experimenting with the 1Password CLI on OpenBSD.
- No hardware Yubikey support for the desktop application. I have Yubikeys working in FreeBSD but the Linux layer doesn't seem to read them. This is probably a permissions or package thing, but I haven't investigated much.
- No persistent login as 1Password doesn't seem to talk to Kwallet, meaning
- You have to re-authenticate with 2FA every time you start 1Password
- No interaction with the Firefox extension; they do not know about each other, so unlocking one does not unlock the other.
- There is probably some way this increases the envelope of exposure if a threat actor has local access to your machine. I imagine something, somewhere is exposed in a vulnerable way, because I don't have confidence it's not. I'm paranoid though. But don't log into your work account this way until someone from 1Password says it seems okay.
I did this on my home gaming PC, an Intel 12700KF with 16 GB of RAM running FreeBSD 13.1-RELEASE on an Intel NVMe.
We are going to enable Linux binary compatibility, then set up a basic Debian
stable system with the
debootstrap package, and point the Linux binary compatibility layer at that directory to use its libraries to run Linux programs.
Enable Linux binary compatibility
Add this to
Disable the default mount points by adding the following to
Add our eventual Debian home to the Linux emulation path by adding the following to
Then start the service. This won't do anything yet. It might error out because the location doesn't exist.
# service linux start
Install the base Linux system in a
First install the
# pkg install debootstrap
Then install Debian stable to
/compat/debian. We don't use
/compat/linux because that's reserved for the basic and outdated (CentOS-based) compatibility layer provided by
emulators/linux_base-c7, which we are avoiding. You don't have to use Debian stable, but I prefer stable OSs on desktops, especially for things like this, where you want to mostly forget about it after getting it working.
To install Debian stable, run the following:
# debootstrap stable /compat/debian https://deb.debian.org/debian
Link the bootstrapped Linux system to the compatibility layer:
# sysctl compat.linux.emul_path="/compat/debian"
chroot into Debian and update the system:
# chroot /compat/debian /bin/bash root@hostname:/# apt update
From your FreeBSD user account, add a user account for yourself on the Linux installation, making sure the user id and group id match. This assumes you have
# doas chroot /compat/debian groupadd -g $(id -g) $(id -gn) # doas chroot /compat/debian useradd -u $(id -u) -g $(id -g) $(id -un)
I believe I ran the following to make sure the dependencies for 1Password were loosely present. I don't think most of these are required, as 1Password comes with its own linked
ffmpeg, but this might help someone get unstuck.
# apt install pulseaudio ffmpeg curl gpg xterm x11-apps
I recommend having two terminals open, one for FreeBSD and one
chroot-ed into Linux. If you forget which one is which, run
stat -c %i /. If it's a low number you're in FreeBSD. A high number means you're in a
In Linux, add the following line to
/etc/hosts. My hostname is
medusa, and I set it to that in Linux's
/etc/hostname for consistency.
This is where my records get somewhat confused.
/etc/fstab, add the following if they aren't already there.
debootstrap might have added some of these already. The last line ensures that the Linux and FreeBSD share the temporary filesystem, which seems to keep 1Password and Xorg happy. This Stack Exchange question illustrates solutions to different issues that can come up with respect to Xorg's permissions needs.
devfs /compat/debian/dev devfs rw,late 0 0 tmpfs /compat/debian/dev/shm tmpfs rw,late,size=1g,mode=1777 0 0 fdescfs /compat/debian/dev/fd fdescfs rw,late,linrdlnk 0 0 linprocfs /compat/debian/proc linprocfs rw,late 0 0 linsysfs /compat/debian/sys linsysfs rw,late 0 0 /tmp /compat/debian/tmp nullfs rw,late 0 0
After adding this, run
mount -a to mount everything in
/etc/fstab, then check that they're mounted with
df -h or your favorite mount listing command.
Restart the Linux emulation service. You might have to replace
# service linux restart
At this point, check whether Xorg and Debian can talk by running the following from FreeBSD:
# chroot /compat/debian xeyes
You'll probably get something like
Error: Can't open display: :0. We'll create a script to work around that to launch 1Password, but you can try the following if you want to test things directly. If you launch X automatically as root, try running
xhost +local:$(id -un) or
xhost +local:root. In combination with your user account on the Linux system that matches your FreeBSD user id and group id, should allow you to run Linux X applications.
chroot-ed Debian environment, follow the instructions for Debian. If it complains about something, you might have, like me, forgotten to install
gpg. I don't remember having to do anything special here.
In FreeBSD, create the following script at
/usr/local/bin/1password. This is how you'll launch 1Password from the command line. It ensures the right arguments for Electron. You might find this useful if you use other Electron-based applications.
#!/compat/debian/bin/bash export OPW_PATH="/opt/1Password/1password" export OPW_WRAPPER="$(readlink -f "$0")" export LIBGL_DRI3_DISABLE=1 exec -a "$0" "$OPW_PATH" --no-sandbox --no-zygote --test-type --v=0 "$@"
To register 1Password and its
onepassword:// URIs with your well-behaved and inclusive desktop environment, create the following file at
X-KDE-Protocls\=onepassword is KDE-specific. This will help when authenticating your 1Password.com account, as it uses that URI style to communicate with the desktop app.
[Desktop Entry] Type=Application Version=1.0 Encoding=UTF-8 Name=1Password Comment=All your passwords Icon=1Password Exec=/usr/local/bin/1password %U Categories=Application; MimeType=x-scheme-handler/onepasswd;x-scheme-handler/onepassword; X-KDE-Protocols=onepassword StartupNotify=true
If you get stuck
I found a lot of things were fixed or reset by restarting your system. The one thing that didn't stick for me was getting
compat.linux.emul_path="/compat/debian" to stick in
/etc/sysctl.conf. I don't know what did it, but one day it stuck.
If you got this far, please let me know how it went!